Product:

Cms_made_simple

(Cmsmadesimple)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 151
Date Id Summary Products Score Patch Annotated
2018-04-13 CVE-2018-10082 CMS Made Simple (CMSMS) through 2.2.7 allows physical path leakage via an invalid /index.php?page= value, a crafted URI starting with /index.php?mact=Search, or a direct request to /admin/header.php, /admin/footer.php, /lib/tasks/class.ClearCache.task.php, or /lib/tasks/class.CmsSecurityCheck.task.php. Cms_made_simple 5.3
2018-04-13 CVE-2018-10081 CMS Made Simple (CMSMS) through 2.2.6 contains an admin password reset vulnerability because data values are improperly compared, as demonstrated by a hash beginning with the "0e" substring. Cms_made_simple 9.8
2018-04-11 CVE-2018-10033 CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter. Cms_made_simple 4.8
2018-04-11 CVE-2018-10032 CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter. Cms_made_simple 4.8
2018-04-11 CVE-2018-10031 CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/moduleinterface.php. Cms_made_simple 8.8
2018-04-11 CVE-2018-10030 CMS Made Simple (aka CMSMS) 2.2.7 has CSRF in admin/siteprefs.php. Cms_made_simple 8.8
2018-04-11 CVE-2018-10029 CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter, related to moduledepends, a different vulnerability than CVE-2017-16799. Cms_made_simple 4.8
2018-04-18 CVE-2018-1000158 cmsmadesimple version 2.2.7 contains a Incorrect Access Control vulnerability in the function of send_recovery_email in the line "$url = $config['admin_url'] . '/login.php?recoverme=' . $code;" that can result in Administrator Password Reset Poisoning, specifically a reset URL pointing at an attacker controlled server can be created by using a host header attack. Cms_made_simple 8.8
2018-03-13 CVE-2018-1000094 CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension. Cms_made_simple 7.2
2018-03-13 CVE-2018-1000092 CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6. Cms_made_simple 8.8